Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.CloudCorpRecords/firmproof

NPM · @RENETURCIOS/FIRMPROOF · 2 COMPONENTS

Official company checks for the UK, France and Spain: lookup, verify, screen, monitor.

69 Trust /100

Last scanned (3 hours ago)

Scores higher than 37% of npm servers

Category CRM and Sales

Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 30 of 92 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability66
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 4796 tokens (~252/item across 19 items; 19 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management3
  • Stability observed for 1 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage98
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 95% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 19 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 19 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 5 Nov 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 0 to 3. That category is still filling its 30-day observation window: 0 days of observed history at the previous scan, 1 at this one. The score rises as the window fills, whether or not the server changes.

  • 4 Nov 26 68

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 5 Nov 2026 · Analysed npm/@reneturcios/firmproof@0.1.0

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 92 packages
Packages resolved 92
Stale 30
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 19 exposed · ~4,796 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
check_address ~203

Validate a company's registered address against the official address base: France via API Adresse (Base Adresse Nationale, IGN). Use it to check that an address exists and is the company's, or to geolocate it. Don't use it to find companies: call search_companies. Inputs: country and identifier, as lookup_company (e.g. 'FR', '441639465'). Returns: validated (true, false or null with a reason), normalized address, BAN ids, coordinates, precision, confidence, and how many active companies share the address. Limits: 1 unit. Spain not available yet. Read-only.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
identifierstringyesOfficial ID, as lookup_company: FR SIREN (9 digits), SIRET or VAT; ES Registro Mercantil sheet, e.g. VI-23266. GB: Companies House company number, e.g. 00445790.

No output schema declared.

No examples provided.

check_insolvency ~216

Check a company's insolvency notices and state: France from BODACC (safeguard, reorganisation, liquidation, plans, closures), Spain from BORME insolvency acts. Use it for credit or supplier checks. Don't use it for sanctions: call screen_company. Inputs: country and identifier, as lookup_company (e.g. 'FR', '441639465'). Returns: state (in_procedure, under_plan, closed, notice_found, none_found, not_covered), procedure, dates, notices with official citations, covered_since. Limits: 1 unit. No notice outside the loaded years is not proof of no procedure. Read-only.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
identifierstringyesOfficial ID, as lookup_company: FR SIREN (9 digits), SIRET or VAT; ES Registro Mercantil sheet, e.g. VI-23266. GB: Companies House company number, e.g. 00445790.

No output schema declared.

No examples provided.

check_supplier_list ~238

Check a supplier list against the official registers: which suppliers are ok, which need a look and why (e.g. in liquidation since a date, per BODACC), with a proof code each, and a private report link to share. Use it for 2 to 100 suppliers at once, or to read a batch you started. Don't use it for one company: call verify_company. Inputs: rows [{reference, company_name, country, identifier}] (an official ID is best; a name alone counts only with postal_code and street matching one company), or batch_id. Returns: counts by review_state (ok, review, could_not_confirm, not_covered, error), the review rows with reasons, share_url; 'next' when still checking. Limits: 5 units a row (+2 for a name), checks reused 24 h free. A registry check, not KYB or sanctions clearance; no person's name.

NameTypeReqDescription
batch_id––A batch this key started, e.g. sb_3Kq9…
rows––Up to 100 suppliers. Leave out to read a batch_id.

No output schema declared.

No examples provided.

check_vat ~189

Give a company's EU VAT number and how it was obtained. Registration is never checked: the answer links the official VIES page. Use it to fill an invoice or a supplier file. Don't use it as proof of VAT registration: check it on VIES. Inputs: country and identifier, as lookup_company (e.g. 'FR', '441639465'). Returns: number, origin (published or computed), registration_checked false, note, check_url. Limits: 1 unit. Spain: no VAT numbers published. Read-only.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
identifierstringyesOfficial ID, as lookup_company: FR SIREN (9 digits), SIRET or VAT; ES Registro Mercantil sheet, e.g. VI-23266. GB: Companies House company number, e.g. 00445790.

No output schema declared.

No examples provided.

explain_match ~172

Explain why two register records are, or are not, the same company: today's decision with reason codes and evidence, stored decisions, links, and whether they share one Fuentio entity. Use it after resolve_company or lookup_company when you must justify a match or a rejection. Don't use it to find companies: call resolve_company. Inputs: left and right, Fuentio record IDs (e.g. 'FR-SIREN-441639465', 'FR-LEI-969500F7JLTX36OUI695'). Returns: same_entity, summary, decision (status, band, reasons), stored_decisions, links, uncertainty. Limits: 1 unit. Read-only.

NameTypeReqDescription
leftstringyesA Fuentio record ID.
rightstringyesAnother record ID.

No output schema declared.

No examples provided.

get_company_history ~278

See what changed at a company, and when: versions with the fields that changed (address, status), each with its official source. Use it for changes over time. Don't use it for the current state: call lookup_company. Inputs: country FR or ES or GB; identifier as for lookup_company (441639465); optional id_scheme; page. Returns: versions newest first with source, fetched_at and the fields changed; dated events where the source has them (BORME acts, Companies House filings). meta.history_since says where history starts. Limits: 1 unit; keyless 20 units a day. Read-only. France: from Fuentio's first fetch of the company. Spain: from 2 January 2009. United Kingdom: the latest filings, and every change since Fuentio first held it. Search words: historique, historial, cambios, due diligence.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
detailstring–summary: a few key fields; standard (default): the record, long lists shortened; full: everything.
id_scheme––Optional: force the ID type when it is ambiguous.
identifierstringyesOfficial ID, as for lookup_company.
pageinteger–Versions page, 10 per page.

No output schema declared.

No examples provided.

get_evidence ~198

Show the evidence behind what Fuentio says about a company: for each field, the value served and every competing value with its source, record, retrieval time, source link and record hash; and the match decision behind each link. Use it to justify an answer in a review or an audit. Don't use it to look a company up: call resolve_company first for its entity_id. Inputs: entity_id (e.g. 'fu_7K3M9Q2XH4PZ'), optional field (name, status, address, legal_form, creation_date, activity), optional as_of 'YYYY-MM-DD'. Returns: evidence, links, decisions, uncertainty, how_to_check. Limits: 1 unit. Read-only.

NameTypeReqDescription
as_of––YYYY-MM-DD.
entity_idstringyesA Fuentio entity ID (from resolve_company).
field––One field, e.g. status.

No output schema declared.

No examples provided.

get_graph ~187

Show a company's group: its parent and child companies from GLEIF (direct and ultimate parents), company to company, every edge with its source. Use it to map a company's group. Don't use it to look a company up: call resolve_company first for its entity_id. Inputs: entity_id (e.g. 'fu_7K3M9Q2XH4PZ'), depth 1 or 2. Returns: nodes (companies), edges (from, kind parent_of, to, source, evidence), ownership (signals only; beneficial owners not covered), uncertainty. Limits: 2 units; API key required. No people, no director links. A company without an LEI shows no links. Read-only.

NameTypeReqDescription
depthinteger–1 or 2.
entity_idstringyesA Fuentio entity ID (from resolve_company).

No output schema declared.

No examples provided.

get_receipt ~292

Give back the Fuentio receipt of a verification by its proof code: outcome and reasons, status, legal form, registered office, insolvency (what was searched), source, check time, hash and the public link to check it. Use it when the user asks for a receipt or proof of a check. Always ask the user first: 'Normal or detailed receipt?', then call it. Use the proof code from verify_company. Don't use it to run a new check: call verify_company. Inputs: proof_code (e.g. 'FUE-FR-20261015-DZ7TP9', any case; a lookup's meta.receipt.request_id also works, same key), format 'normal' or 'detailed'. Returns: data.markdown, the branded receipt: show it as is; data.text, plain text. Limits: free; 30 a minute. The key that ran the check also sees its reference; anyone else, the public view. Read-only.

NameTypeReqDescription
formatstringyesAsk the user first: 'normal' (the receipt) or 'detailed' (also every check, the signals, changes, sources and the full hash re-checked).
proof_codestringyesThe proof code verify_company returned (FUE-XX-YYYYMMDD-XXXXXX; any case or spacing), or a lookup's meta.receipt.request_id.

No output schema declared.

No examples provided.

list_coverage ~175

List the countries, ID formats and official sources Fuentio covers. Free, no key. Use it first when unsure whether a country or ID format is supported, or to explain coverage. Don't use it to check a company: call lookup_company or search_companies. Inputs: none. Example: list_coverage(). Returns: per country, status (available or planned), coverage level, ID formats with real examples and whether lookup works, regional registers, and sources with licence and update frequency. Limits: 0 units. Read-only. Covered today: France, Spain and United Kingdom. Search words: company registry, KYB, SIREN, RCS, Annuaire des Entreprises, société; BORME, Registro Mercantil, empresa, sociedad; Companies House, company number, Ltd, plc, LLP.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

lookup_company ~543

Look up one company in its official register by ID: status, address, legal form, activity, source and check date. Use it when you have an official ID. Don't use it with a name: call search_companies first. Inputs: country FR or ES or GB; identifier. FR: SIREN 441639465, SIRET 44163946500091, VAT FR63441639465, LEI 969500F7JLTX36OUI695. ES: Registro Mercantil sheet VI-23266, LEI 549300EEJH4FEPDBBR25 (no NIF/CIF). GB: company number 00445790, LEI 2138002P5RNKC5W2JZ46. Optional: id_scheme (if ambiguous), format (json, csv, tsv, markdown, html, xml, ndjson; xlsx or parquet as a 24 h link). Returns: the record, a one-line summary, meta with source, source_url, last_verified_at. Limits: 1 unit (also a valid ID not found); keyless 20/day. France: insolvency from BODACC since 2008. Public contracts won since 2024 (DECP, weekly). Spain: BORME acts since 2 January 2009. UK: no officers or PSCs. No person's name in any answer. For KYB steps, supplier checks, due diligence: SIREN, RCS, Annuaire des Entreprises, société; BORME, Registro Mercantil, empresa, sociedad; Companies House, company number, Ltd, plc, LLP.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
detailstring–summary: a few key fields; standard (default): the record, long lists shortened; full: everything.
formatstring–Answer format: json (default); csv, tsv, markdown, html (table), xml or ndjson come back inline, one row per company with source and fetched_at; xlsx or parquet as a download link valid 24 hours. Sam…
id_scheme––Optional: force the ID type when it is ambiguous.
identifierstringyesOfficial ID. FR: SIREN (9 digits), SIRET (14) or VAT (FR + 11). ES: Registro Mercantil sheet, e.g. VI-23266. GB: Companies House company number, e.g. 00445790.

No output schema declared.

No examples provided.

report_issue ~158

Report an answer you believe is wrong or missing, so Fuentio checks it against the official source. Use it when a result contradicts an official document you hold. Don't use it to ask questions: call the lookup tools. Inputs: subject (entity ID, record ID such as 'FR-SIREN-441639465', or tool name), category (wrong_data, wrong_link, missing_data, wrong_status, other), message. Returns: issue_id, status 'open'. Limits: free; API key required; 20 reports per key per day.

NameTypeReqDescription
categorystringyes–
messagestringyesWhat you expected and what you got.
subjectstringyesEntity ID, record ID or tool name.

No output schema declared.

No examples provided.

resolve_company ~259

Decide whether a company you know (an official ID, or a name with a postcode or town) is a company in the official registers, with evidence: candidates each with a decision, linked, possible or rejected, and the reasons. Use it to match a supplier or customer record to a register record. Don't use it to read a company you already identified: call lookup_company. Inputs: country FR or ES or GB; name ('Renault', postal_code '92100') and/or identifier (441639465); optional id_scheme, locality, limit (1-10). Returns: outcome (linked, possible_match, no_match), uncertainty, best, candidates with entity_id, reason codes and evidence. Limits: 2 units. Only an official ID links: a name, even with an address, is never proof. Read-only, nothing stored.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
id_scheme––Optional: force the ID type.
identifier––An official ID, if you have one: the only thing that links exactly.
limitinteger–Candidates.
locality–––
name––The company's name as you have it.
postal_code–––

No output schema declared.

No examples provided.

review_report ~233

Produce one review-ready report on a company: identity and links with reasons, facts with sources, last year's changes and gaps, and every check at once (insolvency, sanctions, address, VAT, and in France the public contracts won). Use it for the registry part of a KYB or supplier review you must file (not full KYB: no UBO, PEP or adverse-media checks). Don't use it for one quick fact: call lookup_company. Inputs: country and identifier, as lookup_company (e.g. 'FR', '441639465'). Returns: company, facts, links, decisions, changes_last_year, modules, gaps, uncertainty, sha256, markdown. Limits: 8 units; API key required. Read-only.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
identifierstringyesOfficial ID, as lookup_company: FR SIREN (9 digits), SIRET or VAT; ES Registro Mercantil sheet, e.g. VI-23266. GB: Companies House company number, e.g. 00445790.

No output schema declared.

No examples provided.

screen_company ~238

Screen a company's own names against sanctions lists: EU Financial Sanctions File, UK Sanctions List, OFAC SDN list, France's registre des gels. Use it as the sanctions-list step of onboarding a supplier or customer (not full KYB). Don't use it to identify a company: call resolve_company or lookup_company first. Inputs: country and identifier, as lookup_company (e.g. 'FR', '441639465'). Returns: result 'possible_match' (list, entry, score, reasons, listing date, legal act, official link), 'no_match_found' or 'not_checked', the list versions, and a note. Limits: 2 units; API key required. A possible match is not proof; no match is never 'clear'. Read-only.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
identifierstringyesOfficial ID, as lookup_company: FR SIREN (9 digits), SIRET or VAT; ES Registro Mercantil sheet, e.g. VI-23266. GB: Companies House company number, e.g. 00445790.

No output schema declared.

No examples provided.

search_companies ~490

Find companies by name in the official registers of France, Spain and United Kingdom, 10 per page. Use it when you know a name but no ID, then call lookup_company or verify_company with an ID from the results. Don't use it when you already have an official ID. Inputs: country FR or ES or GB; query, 2 to 200 characters ('telefonica'). Optional: postal_code, locality, status, jurisdiction (regional registers), page, format; limit (up to 100 rows) with a file format. Returns: best match first, each with match.score (0-1) and reasons, name, status, address, IDs, provenance; meta.next_page. Limits: 2 units a page; files 2 per started 25 rows. Read-only. France: insolvency from BODACC since 2008. Public contracts won since 2024 (DECP, weekly). Spain: BORME acts since 2 January 2009. UK: no officers or PSCs. No person's name in any answer. Search words: SIREN, RCS, Annuaire des Entreprises, société; BORME, Registro Mercantil, empresa, sociedad; Companies House, company number, Ltd, plc, LLP, KYB, supplier check.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
formatstring–Answer format: json (default); csv, tsv, markdown, html (table), xml or ndjson come back inline, one row per company with source and fetched_at; xlsx or parquet as a download link valid 24 hours. Sam…
jurisdiction––Optional ISO 3166-2 region to search in, for countries with regional registers (list_coverage lists them).
limit––Rows in one file, up to 100, with a non-json format only. 2 units per started 25 rows (100 rows = 8 units).
locality––Registered-office town filter (Spain).
pageinteger–Results page, 10 per page.
postal_code––Registered-office postal code filter.
querystringyesCompany name, 2 to 200 characters.
status––Only companies with this status.

No output schema declared.

No examples provided.

verify_company ~374

Verify a company against its official register, for onboarding or before paying or signing: an outcome with reasons, checks, warning signals and a proof code you can show an auditor. A registry check, not full KYB. Use it to decide about a company. Don't use it for a cheap single read (lookup_company) or with a name (call search_companies first). Inputs: country FR or ES or GB; identifier as for lookup_company (441639465); optional id_scheme; optional reference (your case id). Returns: outcome (verified, partial, unverified; open insolvency never verified) + reasons, checks, signals (present, none_found, not_covered), recent changes, provenance, proof code (FUE-…). Limits: 5 units (1 if not found); keyless 20/day. Stored 24 months. France: insolvency from BODACC since 2008. Public contracts won since 2024 (DECP, weekly). Spain: BORME acts since 2 January 2009. UK: no officers or PSCs. No person's name in any answer. Search words: KYB, KYC, verify supplier, vérifier une société, verificar empresa.

NameTypeReqDescription
countrystringyesISO country code: FR or ES or GB.
detailstring–summary: a few key fields; standard (default): the record, long lists shortened; full: everything.
id_scheme––Optional: force the ID type.
identifierstringyesOfficial ID: FR SIREN or SIRET; ES Registro Mercantil sheet from search_companies. GB: Companies House company number, e.g. 00445790. Never a name.
reference––Optional: your own case id, stored with the result.

No output schema declared.

No examples provided.

watch_company ~141

Watch a company: when its official records change, Fuentio POSTs the changes, signed, to your https endpoint. Use it to monitor a supplier or customer. Don't use it for a one-off check: call what_changed. Inputs: entity_id (from resolve_company), callback_url (your https endpoint; private or local addresses are refused). Returns: watch_id, signing_secret (shown once) and how to verify each POST. Limits: 1 unit; API key required; free plan 3 watches.

NameTypeReqDescription
callback_urlstringyesYour https endpoint.
entity_idstringyesA Fuentio entity ID (from resolve_company).

No output schema declared.

No examples provided.

what_changed ~212

List what changed at a company since a date, from every official record Fuentio holds for it: status, name, address, legal form, and the source's dated events (BORME acts), each with its source and evidence. Use it to review a supplier or customer since your last check. Don't use it for the current state: call lookup_company. Inputs: entity_id (from resolve_company, e.g. 'fu_7K3M9Q2XH4PZ'), since 'YYYY-MM-DD', optional until. Returns: changes (type, old/new or added/removed, observed_at or effective_date, source, evidence), gaps (days not loaded, sources not checked since), uncertainty. Limits: 1 unit. A gap is never reported as no change. Read-only.

NameTypeReqDescription
entity_idstringyesA Fuentio entity ID (from resolve_company).
sincestringyesYYYY-MM-DD.
until––YYYY-MM-DD; default today.

No output schema declared.

No examples provided.

Install

How do I install the io.github.CloudCorpRecords/firmproof MCP server?

io.github.CloudCorpRecords/firmproof runs locally as an npm package, launched with npx -y @reneturcios/firmproof. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @reneturcios/firmproof

# add to Claude Code
claude mcp add cloudcorprecords-firmproof -- npx -y @reneturcios/firmproof
Common questions

What is the io.github.CloudCorpRecords/firmproof MCP server?

io.github.CloudCorpRecords/firmproof is an MCP server listed in the public MCP registry as io.github.CloudCorpRecords/firmproof. Official company checks for the UK, France and Spain: lookup, verify, screen, monitor. This page covers its npm package (@reneturcios/firmproof).

Is the io.github.CloudCorpRecords/firmproof MCP server safe to use?

io.github.CloudCorpRecords/firmproof scores 69 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.CloudCorpRecords/firmproof MCP server expose?

io.github.CloudCorpRecords/firmproof exposes 19 tools: lookup_company, search_companies, get_company_history, verify_company, get_receipt, and 14 more. Their descriptions and schemas cost roughly 4,796 tokens of context every time the server is loaded.

Is the io.github.CloudCorpRecords/firmproof MCP server still maintained?

io.github.CloudCorpRecords/firmproof is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.CloudCorpRecords/firmproof MCP server under?

io.github.CloudCorpRecords/firmproof declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.